Legal
Privacy Policy
This policy explains what personal information Beam Laser Clinic collects, why we need it, how we look after it and what rights you have over it. Some of what we hold is information about your health, which the law treats as especially sensitive, so we have set that out in detail below.
1. Who we are
Beam Laser Clinic (“we”, “us”) is the data controller for the information described here. That means we decide what is collected and how it is used, and we are legally responsible for it.
- Clinic Beam Laser Clinic, 127 Wandsworth High Street, London SW18 4JB
- Contact 07511 161762 · WhatsApp 07511 161762 · or write to us at the clinic address above
- Responsible person Rose, Clinic Owner and Laser Clinician
- ICO registration [ICO registration number to be inserted]
Anyone processing health data in the UK must normally register with the Information Commissioner’s Office and pay the annual data protection fee. If this is not yet in place, it should be arranged before the clinic begins treating clients.
2. What information we collect
| Category | Examples |
|---|---|
| Identity & contact | Name, date of birth, phone number, postal address, emergency contact |
| Health information special category | Medical history, medication, allergies, skin type (Fitzpatrick), previous treatments, contraindications, pregnancy or breastfeeding status, patch test results, treatment records and settings used |
| Photographs special category | Clinical before-and-after images of treated areas, where you have agreed to them |
| Appointment & financial | Bookings, attendance, treatment plans, payments, invoices and refunds |
| Correspondence | WhatsApp messages, texts and notes of calls with us |
| Marketing preferences | Whether you have opted in to hear from us, and how you would like to be contacted |
We ask only for what we genuinely need in order to treat you safely. If you would rather not give us something, we will tell you what that means — in some cases we may not be able to treat you without it.
3. Why we use it, and our lawful basis
Data protection law requires us to have a valid reason (a “lawful basis”) for everything we do with your information.
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Book and manage your appointments | Article 6(1)(b) — performance of a contract |
| Screen you medically and assess suitability | Article 6(1)(c) legal obligation & Article 9(2)(h) health care |
| Carry out patch tests and treatments, and keep clinical records | Article 6(1)(b) contract & Article 9(2)(h) health care |
| Take payment and keep accounting records | Article 6(1)(c) — legal obligation (HMRC) |
| Answer your enquiry before you become a client | Article 6(1)(f) — legitimate interests (responding to you) |
| Send appointment reminders and aftercare | Article 6(1)(b) — performance of a contract |
| Send marketing, offers or newsletters | Article 6(1)(a) — your consent (you can withdraw any time) |
| Use photographs in marketing | Article 6(1)(a) consent & Article 9(2)(a) explicit consent |
| Defend a legal claim or respond to a complaint | Article 6(1)(f) legitimate interests & Article 9(2)(f) legal claims |
| Comply with insurance and professional obligations | Article 6(1)(c) — legal obligation |
4. Health information — special category data
Information about your health is treated as special category data under Article 9 of the UK GDPR and is given extra protection. We rely on:
- Article 9(2)(h) — processing necessary for the provision of health care and treatment, together with Schedule 1 Part 1 of the Data Protection Act 2018. Your clinician works under a duty of confidentiality.
- Article 9(2)(a) — your explicit consent, for anything outside direct care, such as marketing photographs.
- Article 9(2)(f) — where needed to establish or defend a legal claim.
We do not rely on consent as the basis for your clinical records. This is deliberate: if we did, withdrawing consent would oblige us to delete records we are professionally and legally required to keep. Treating your records under the health care condition means they remain available if a late-onset reaction or a complaint ever needs investigating.
We do not use your data for automated decision-making or profiling. Every treatment decision is made by a person.
5. Photographs
Clinical photographs help us track how your skin is responding between sessions. Where we take them:
- Photographs for your clinical record are part of your treatment and are covered by Article 9(2)(h).
- Photographs used publicly — on our website, Instagram or in print — are never used without your separate, specific, written consent. That consent is asked for on its own, not bundled into your treatment consent form.
- You can withdraw photo consent at any time and we will remove the image from anything we control. We cannot always recall material already reshared by others.
- Images are stored separately from your identifying records wherever practical.
6. Who we share it with
We never sell your data, and we do not share it for anyone else’s marketing. We share only where necessary:
- Your GP or specialist Only with your knowledge, if a medical concern needs referral
- Insurers & legal advisers If a complaint, incident or claim arises
- Payment providers To take card payments. We never see or store your full card number
- IT & booking software Suppliers who host our systems under written contracts requiring them to protect your data and act only on our instructions
- Regulators The ICO, the GDC, or other authorities where the law requires it
- WhatsApp (Meta) If you choose to message us — see section 10
7. How long we keep it
| Record | Retention period | Reason |
|---|---|---|
| Clinical and treatment records (adults) | 10 years from your last treatment | Professional and insurance requirements; late-onset reactions |
| Clinical records (under 18s) | Until their 25th birthday, or 10 years from last treatment, whichever is longer | Standard practice for minors’ health records |
| Clinical photographs | Same as the clinical record | Part of the treatment record |
| Marketing photographs | Until you withdraw consent | Consent-based |
| Financial and payment records | 6 years from the end of the tax year | HMRC requirement |
| Enquiries that do not become bookings | 12 months | Legitimate interest; then deleted |
| Marketing contact details | Until you unsubscribe, or 24 months of no engagement | Consent-based |
| CCTV, if installed | 30 days | Security |
When a retention period ends, paper records are destroyed by a confidential waste service and digital records are permanently deleted.
8. How we keep it safe
- Paper records are kept in a locked cabinet in the clinic and are never left unattended.
- Digital records are held in password-protected systems with two-factor authentication and encryption.
- Only Rose and any authorised clinical staff can access client records.
- Devices are encrypted, password-protected and kept up to date.
- Anyone working with us is bound by confidentiality.
If a breach ever occurs and it is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you directly where the risk to you is high.
9. This website
This website sets no cookies and runs no analytics or advertising trackers. There is no sign-up, no account and no database behind it.
- No tracking. We do not use Google Analytics, advertising pixels or any third-party tracking.
- Fonts are self-hosted. Nothing is requested from Google Fonts, so your visit is not shared with Google.
- The map is off until you ask for it. Google Maps is only loaded when you tap “Show map”. Until then, nothing is sent to Google. If you do load it, Google’s own privacy policy applies.
- The booking form does not submit anywhere. What you type is assembled into a WhatsApp message on your own device. Nothing is stored on this site, and no data reaches us unless you press send.
- Hosting. The site is hosted on Microsoft Azure, which keeps standard server logs including IP addresses for security purposes.
10. If you contact us on WhatsApp
WhatsApp is our main way of taking enquiries, so it is worth being clear about it.
- WhatsApp messages are end-to-end encrypted in transit, so their content cannot be read by WhatsApp.
- However, WhatsApp is owned by Meta, which processes metadata such as your phone number and when you messaged. Meta is a separate data controller and its own privacy policy applies. Some of that processing takes place outside the UK, under approved safeguards.
- We keep your messages as part of your enquiry or clinical record, under the retention periods above.
- Please avoid sending detailed medical information or intimate photographs over WhatsApp. Bring those to your consultation instead, where they can be recorded properly and kept securely.
- Prefer not to use WhatsApp? Call the clinic instead and we will take your enquiry by phone.
11. Your rights
You have the following rights over your information. All of them are free to use, and we will respond within one month.
- Access Ask for a copy of everything we hold about you
- Rectification Have anything inaccurate corrected
- Erasure Ask us to delete your data — though we may have to keep clinical records for the periods above, and we will explain if so
- Restriction Ask us to pause using your data while a concern is resolved
- Portability Receive your data in a portable format, or have it sent to another provider
- Object Object to processing based on legitimate interests
- Withdraw consent Withdraw consent for marketing or photographs at any time, without affecting your treatment
To exercise any of these, call or message the clinic on 07511 161762, or write to us at 127 Wandsworth High Street, London SW18 4JB. We may ask you to confirm your identity first, so that we do not disclose your information to someone else.
12. Complaints
If you are unhappy with how we have handled your information, please tell us first — we would like the chance to put it right. You also have the right to complain to the UK regulator at any time:
- Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Helpline 0303 123 1113
- Online ico.org.uk/make-a-complaint
Changes to this policy
If we change how we use your information we will update this page and change the date at the top. Where a change is significant, we will tell you directly.